Tesla Model 3 Rear Drive Unit Hacking

[Jack Bauer]

also ...

[davefiddes]

It's like that scene in 2001 where Dave Bowman starts popping out holographic memory modules form HAL 9000...only this time it's Dave and Damien erasing Elon's flash sectors while he sings "Daisy, Daisy, give me your answer, do..."

[JaniK]

Is this going to be "use once" item or "leave on" the inverter?

I mean, do we just ship it to next person in need, or keep for reprogramming the inverter?

[davefiddes]

It's my intention to have reprogramming of firmware over CAN (everything has to be done over CAN on this board). Implementing that is a long long way down the priority list though...

Unless I'm mistaken Damien's board is USB connected. You'd only hook it up for programming firmware much like the ST-Link V2 that we use for STM32 projects.

[JaniK]

Ok cool. So in the Beginning USB board for every program code version change, later without opening the inverter..?

[davefiddes]

Yep.

[Jack Bauer]

Good morning Dr.Chandra, this is HAL. I'm ready for my first lesson.

This would be the point where the openinverter community rallies around to help Dave with the not insignificant task of porting the OI firmware to the TI mcu....
I'll have usb to jtag plug and play boards ready to go soon so you can all get in on the fun.

Copying in a pootube comment here that may be quite useful :
One warning on this processor family: while you can run programs from RAM at speed, the flash is not fast enough, and if you have any timing critical routines (like your interrupt), the trick is to tell the compiler to locate the interrupt segment in a RAM bank but put a copy in flash, and then at startup before the interrupt is enabled, you copy the code from its flash backup into its RAM home. Once you know this is a thing, the mechanics are straightforward (there's a technote for it), but during my first software development project on these CPUs, to build a program that worked just great from RAM and then have it fall over the first time I ran from flash was quite a shock.

[jetpax]

Really well done Damien!!

Better late than never

Before everyone goes and erases their TMS320F28377DPTPQ flash, maybe a good idea to verify that CAN boot eg https://www.ti.com/lit/an/spna200/spna2 ... 3198324875 is not supported in Elon’s firmware…

Eg with something like https://www.peak-system.com/PCAN-USB.199.0.html?&L=1

[Jack Bauer]

On the subject of erasing micros. Could folks please have a look over the attached and see if I've done something stupid before I go ordering boards from JLC and waste even more time ...

Its basically a copy of the TI xds100v2 USB-JTAG used on their 28379d launchpad board using JLC parts. The connection to the driveunit features a stupidly small 1mm pitch hirose header with crimp terminals about the size of a flea. To avoid that fun I'm going to go with a Harwin M40-3100545R mounted on the rear of the board under the little arm that should make it a plug and go solution thus avoiding the crimping nightmare.

[davefiddes]

It's a pity Hirose don't have a female version of the PCB connector. I think the connector ought to mate though it is definitely designed for square pins and the Hirose DF20 pins are rectangular. Might be worth testing one mechanically before committing if you haven't already.

Electrically it matches the FT2232-56Q Mini Module based JTAG adapter I built. Seems to follow the layout, PSU guidelines from FTDI. PCB connector orientation and connection seems to be correct.

Can we have a ground pin on the serial port connector?

One thing to note, without an isolator the JTAG adapter seems to back-power the board (presumably via protection diodes) when the inverter is powered off. I'm hoping bad things don't happen but the gate driver fault LED glows dimly.

[Jack Bauer]

Thanks Dave. Yeah I noticed the power via jtag also. What I do is disconnect jtag first and connect last. I'll do an iso version once this one is proven working.

On another note just found an error is my pinout for the CAN Tx and Rx. I had them swapped and of course the compiler got angry with me. Now fixed and we are churning out some can, running some basic task timers and of course flashing the all important leds. ooohhh....I wonder could I get cpu2 to flash one led and cpu1 the other. Seems like a good use of a spare processor and my time:)

[Jack Bauer]

Mods done and jtag boards ordered from jlcpcb. Will make kits available once tested.

[JaniK]

That was fast. Nice Job.

[EV_Builder]

Can you give me a link to those glasses??
I checked but coudn't find your white ones. now i see you got some others/new ones on.

[Jack Bauer]

https://www.amazon.de/-/en/Carson-Magni ... B00UCU98Q0

[EV_Builder]

Trying to source: TMS320F28377DPTPT ...

Is this the correct part?

[davefiddes]

Technically it's the PTPQ part that should be used as that's the automotive temperature variant. PTPT parts are fine from a functional perspective though. All important parts are detailed on the wiki: https://openinverter.org/wiki/Tesla_Mod ... Components

Do you mind me asking why you are looking for these parts?

[EV_Builder]

On the subject of erasing micros. Could folks please have a look over the attached and see if I've done something stupid before I go ordering boards from JLC and waste even more time ...

Its basically a copy of the TI xds100v2 USB-JTAG used on their 28379d launchpad board using JLC parts. The connection to the driveunit features a stupidly small 1mm pitch hirose header with crimp terminals about the size of a flea. To avoid that fun I'm going to go with a Harwin M40-3100545R mounted on the rear of the board under the little arm that should make it a plug and go solution thus avoiding the crimping nightmare.

My only concern is that the FTDI can/must be programmed to popup in your PC and load the appropriate drivers etc. So the application uses it for what it is. contact me over PB and I will tell you more what i know. Since this type of stuff is used for cloning adapters.

[EV_Builder]

Technically it's the PTPQ part that should be used as that's the automotive temperature variant. PTPT parts are fine from a functional perspective though. All important parts are detailed on the wiki: https://openinverter.org/wiki/Tesla_Mod ... Components

Do you mind me asking why you are looking for these parts?

If I buy a M3 engine for my conversion i will need this cpu right?
I could help with the porting too having the platform to run the code on.

[JaniK]

Technically it's the PTPQ part that should be used as that's the automotive temperature variant. PTPT parts are fine from a functional perspective though. All important parts are detailed on the wiki: https://openinverter.org/wiki/Tesla_Mod ... Components

Do you mind me asking why you are looking for these parts?

If I buy a M3 engine for my conversion i will need this cpu right?
I could help with the porting too having the platform to run the code on.

The CPU / MCU on the M3 inverter can be flashed and so you do not need a separate one to buy.

That is shown on the video, start from 53 minutes.

[davefiddes]

My only concern is that the FTDI can/must be programmed to popup in your PC and load the appropriate drivers etc. So the application uses it for what it is. contact me over PB and I will tell you more what i know. Since this type of stuff is used for cloning adapters.

You are right to point out that FTDI FT2232H adapters will need to be programmed. It's pretty straight forward though. You need the FT_PROG utility and a configuration template. TI handily publish all of their ones and I used the one for the LAUNCHXL-F28379. I wrote up how I created my JTAG cable for posterity.

Looks like it's possible to do on Linux with a utility called ftdi_eeprom. It takes different input from the official FTDI tool and might be a bit more tiresome to use.

[EV_Builder]

Technically it's the PTPQ part that should be used as that's the automotive temperature variant. PTPT parts are fine from a functional perspective though. All important parts are detailed on the wiki: https://openinverter.org/wiki/Tesla_Mod ... Components

Do you mind me asking why you are looking for these parts?

If I buy a M3 engine for my conversion i will need this cpu right?
I could help with the porting too having the platform to run the code on.

The CPU / MCU on the M3 inverter can be flashed and so you do not need a separate one to buy.

That is shown on the video, start from 53 minutes.

Pfffff wtf ...
Makes ordering a M3 motor tempting.
Should I go for the 800Amps version?
Front or Rear? The technologies are not the same if you trust the YouTube info about them.

[davefiddes]

Am I correct Dave/Damien?

As far as we are aware all you need to do is hook up a JTAG adapter and erase the flash and you can put whatever you like on there. There may be cleverness relating to the OTP bits Tesla have set that we don't understand yet but at this point in time we believe that to be true.

[davefiddes]

I've spent a bit of time documenting my current code and getting it pushed to Github: https://github.com/davefiddes/stm32-sine

It comes with a serious health warning. This is not at the point that you can run it on a Tesla Model 3 inverter. If you do so it may damage your hardware permanently.

The README on github explains how to get the code up and building. To summarise what it currently does:

• Port core libopeninv code to work on x86_64 and C2000 with unit tests
• Hardware independent Field Oriented Control / Sine PWM generation (statically virtualised C++ classes using CRTP)(don't ask)
• Port and update existing unit tests and extend to verify FOC PWM generation
• Fix integer overflows affecting C2000 in PWM generation, SineCore and libopeninv

The code will run on a TI LAUNCHXL-F28379D eval board and generate PWM signals running the main FOC control loop with a compiled in shaft angle and velocity. I'm just doing fixed point maths for now to allow easier comparison with the regular STM32 code. Despite the short list of working stuff I'm about 2 months of full-time work in so far and have been working on it since April. Integer overflow bugs take a lot of effort to find and fix...the TMS320 family of CPUs have 16-bit ints and char is also 16-bit which is quite unusual...

My next step from here is to work to port the gate driver and PMIC drivers I wrote back in the spring for STM32 to the C2000. Assuming these can be made to work it should be possible to get high-voltage PWM signals on the Tesla M3 inverter.

We're a very long way from a minimum viable inverter that folks can test or get involved with in any meaningful way. Thought I'd take the time to share where I was at in the interest of openness.

[EV_Builder]

Yeah; I just saw the video and edited my post....
Learned a lesson here to finish the videos completely which I always do but today didn't.

Yes; even the memory addressing is per 2 increments if I recall correctly.

About the FTDI I didn't know TI had it open so yes that was what I meant.